@server/next 0.41.0 → 0.42.0

package/index.d.ts

@@ -182,10 +182,9 @@ type KVStore = {
 type Provider = "email" | "github" | "google" | "microsoft" | "discord" | "facebook" | "apple";
 type Strategy = "cookie" | "jwt" | "token";
 type AuthSession = {
-    id: string;
-    provider: Provider;
-    strategy: Strategy;
     user: string;
+    provider: Provider;
+    created: string;
 };
 type AuthUser<T = Record<string, any>> = T & {
     id: string | number;
@@ -200,22 +199,22 @@ type ProfileUser = {
 type AuthOption = `${Strategy}:${Provider}` | {
     strategy: Strategy;
     providers?: Provider | Provider[];
-    session?: StoreSource;
-    store?: StoreSource;
+    users?: StoreSource;
     redirect?: string;
     onProfile?: (raw: any, provider: Provider) => ProfileUser | Promise<ProfileUser>;
     onLogin?: (loginUser: AuthUser, existingUser: AuthUser | null, ctx: Context) => ProfileUser | Promise<ProfileUser>;
     onUser?: <T = AuthUser>(user: T, ctx: Context) => T | Promise<T>;
+    onToken?: (user: AuthUser, ctx: Context) => ProfileUser | Promise<ProfileUser>;
     onLogout?: (ctx: Context) => unknown;
 };
 type AuthSettings = {
     providers: Provider[];
     strategy: Strategy;
-    store: KVStore;
-    session: KVStore;
+    users: KVStore;
     onProfile?: (raw: any, provider: Provider) => ProfileUser | Promise<ProfileUser>;
     onLogin?: (loginUser: AuthUser, existingUser: AuthUser | null, ctx: Context) => ProfileUser | Promise<ProfileUser>;
     onUser: <T = AuthUser>(user: T, ctx: Context) => T | Promise<T>;
+    onToken: (user: AuthUser, ctx: Context) => ProfileUser | Promise<ProfileUser>;
     onLogout?: (ctx: Context) => unknown;
     redirect: string;
 };
@@ -254,10 +253,7 @@ type Options = {
     secret?: string;
     public?: string | Bucket;
     uploads?: string | Bucket | UploadOptions;
-    store?: StoreSource;
-    session?: StoreSource | {
-        store: StoreSource;
-    };
+    sessions?: StoreSource;
     cors?: CorsOptions;
     auth?: AuthOption;
     openapi?: any;
@@ -276,10 +272,8 @@ type Settings = {
     uploads?: ({
         bucket: Bucket;
     } & LimitOptions) | null;
-    store?: KVStore;
-    session?: {
-        store: KVStore;
-    };
+    sessions: KVStore;
+    sessionsDefault?: boolean;
     cors?: CorsSettings;
     auth?: AuthSettings;
     openapi?: any;

package/index.js

@@ -43,20 +43,17 @@ ServerError_default.extend({
     status: 400,
     message: "The route param '{param}' tries to climb the path ('{value}'). If this route legitimately receives paths, set security: { traversalProtection: false }"
   },
-  NO_STORE: "You need a 'store' to write 'ctx.session'",
-  NO_STORE_WRITE: "You need a 'store' to write 'ctx.session.{key}'",
-  NO_STORE_READ: "You need a 'store' to read 'ctx.session.{key}'",
   AUTH_ARGON_NEEDED: "Argon2 is needed for the auth module, please install it with 'npm i argon2'",
   AUTH_INVALID_TOKEN: { status: 401, message: "Invalid Authorization token" },
-  AUTH_INVALID_COOKIE: { status: 401, message: "Invalid Authorization cookie" },
+  AUTH_NO_CODE: {
+    status: 400,
+    message: "Missing the OAuth 'code' in the request body"
+  },
+  SESSION_JWT: "The `jwt` strategy is stateless, so there is no `ctx.session` (tried '{key}'). Use the `token` strategy for server-side sessions, or `cookie` for browsers",
   AUTH_INVALID_HEADER: {
     status: 401,
     message: "Invalid authorization header {type}, must send 'Bearer {TOKEN}' (with space)"
   },
-  AUTH_INVALID_STRATEGY: {
-    status: 401,
-    message: "Invalid Authorization type '{strategy}', valid one is '{valid}'"
-  },
   AUTH_INVALID_STATE: { status: 403, message: "Invalid OAuth state" },
   AUTH_NO_PROVIDER: "No provider passed to the option 'auth.providers'",
   AUTH_INVALID_PROVIDER: {
@@ -729,13 +726,20 @@ function clientIp(headers2, opts = {}) {
 
 // src/helpers/store.ts
 import kv from "polystore";
-function toStore(source) {
+function isStore(source) {
   const store = source;
-  if (store && typeof store.prefix === "function" && typeof store.get === "function" && typeof store.set === "function") {
-    return store;
-  }
+  return Boolean(
+    store && typeof store.prefix === "function" && typeof store.get === "function" && typeof store.set === "function"
+  );
+}
+function toStore(source) {
+  if (isStore(source)) return source;
   return kv(source);
 }
+function toStoreExpiring(source, expires) {
+  if (isStore(source)) return source;
+  return kv(source).expires(expires);
+}
 
 // src/helpers/disposition.ts
 var encodeExt = (name) => encodeURIComponent(name).replace(
@@ -994,50 +998,108 @@ async function verifyJwt(token, secret) {
   return payload;
 }
 
+// src/auth/findSessionId.ts
+var validateToken = (authorization) => {
+  const [type2, id] = authorization.trim().split(" ");
+  if (type2?.toLowerCase() !== "bearer") {
+    throw ServerError_default.AUTH_INVALID_HEADER({ type: type2 });
+  }
+  if (id?.length !== 16) {
+    throw ServerError_default.AUTH_INVALID_TOKEN();
+  }
+  return id;
+};
+function findSessionId(ctx) {
+  const strategy = ctx.options.auth?.strategy;
+  if (strategy?.includes("token") && ctx.headers.authorization) {
+    return validateToken(ctx.headers.authorization);
+  }
+  return ctx.cookies.session || void 0;
+}
+
+// src/middle/session.ts
+var loaded = /* @__PURE__ */ new WeakMap();
+function jwtSession() {
+  const target = {};
+  return new Proxy(target, {
+    get(target2, key) {
+      if (typeof key === "symbol" || key === "then") return target2[key];
+      throw ServerError_default.SESSION_JWT({ key: String(key) });
+    },
+    set(target2, key, value) {
+      if (typeof key === "symbol") {
+        target2[key] = value;
+        return true;
+      }
+      throw ServerError_default.SESSION_JWT({ key: String(key) });
+    }
+  });
+}
+async function session(ctx) {
+  if (ctx.options.auth?.strategy.includes("jwt")) {
+    ctx.session = jwtSession();
+    return;
+  }
+  const id = findSessionId(ctx);
+  ctx.session = id && await ctx.options.sessions.get(id) || {};
+  loaded.set(ctx, { id, data: JSON.stringify(ctx.session) });
+}
+
 // src/auth/finishLogin.ts
-async function finishLogin(ctx, input) {
+async function finishLogin(ctx, input, opts = {}) {
   const settings = ctx.options.auth;
-  const { strategy, onLogin, onUser } = settings;
+  const { strategy, onLogin, onUser, onToken } = settings;
   const key = String(input.key);
   const auth2 = {
-    id: createId(),
-    strategy,
-    provider: input.provider,
     user: key,
-    email: input.email,
-    time: (/* @__PURE__ */ new Date()).toISOString().replace(/\.[0-9]*/, "")
+    provider: input.provider,
+    created: (/* @__PURE__ */ new Date()).toISOString().replace(/\.[0-9]*/, "")
   };
   const loginUser = {
     ...input.user,
     provider: input.provider,
     strategy
   };
-  const existingUser = await settings.store.get(key) ?? null;
+  const existingUser = await settings.users.get(key) ?? null;
   const user = onLogin ? await onLogin(loginUser, existingUser, ctx) : { ...existingUser ?? {}, ...loginUser };
   assertUser(user, "onLogin");
-  await settings.store.set(key, user);
-  if (!strategy.includes("jwt")) {
-    await settings.session.set(auth2.id, auth2, { expires: "1w" });
-  }
+  await settings.users.set(key, user);
   if (strategy.includes("jwt")) {
-    const token = await signJwt(auth2, ctx.options.secret, 7 * 24 * 60 * 60);
-    const exposed = await onUser(user, ctx);
+    const payload = {
+      ...await onToken(user, ctx),
+      provider: input.provider
+    };
+    assertUser(payload, "onToken");
+    const token = await signJwt(payload, ctx.options.secret, 7 * 24 * 60 * 60);
+    const exposed = await onUser(payload, ctx);
     assertUser(exposed, "onUser");
     return status(201).json({ ...exposed, token });
   }
+  const prev = loaded.get(ctx);
+  if (prev?.id) await ctx.options.sessions.del(prev.id);
+  const id = createId();
+  Object.assign(ctx.session, auth2);
+  await ctx.options.sessions.set(id, ctx.session);
+  loaded.set(ctx, { id, data: JSON.stringify(ctx.session) });
   if (strategy.includes("token")) {
     const exposed = await onUser(user, ctx);
     assertUser(exposed, "onUser");
-    return status(201).json({ ...exposed, token: auth2.id });
+    return status(201).json({ ...exposed, token: id });
   }
   if (strategy.includes("cookie")) {
-    return cookies("authentication", {
-      value: auth2.id,
+    const reply = cookies("session", {
+      value: id,
       path: "/",
       httpOnly: true,
       secure: ctx.platform.production,
       sameSite: "Lax"
-    }).redirect(settings.redirect);
+    });
+    if (opts.json) {
+      const exposed = await onUser(user, ctx);
+      assertUser(exposed, "onUser");
+      return reply.status(201).json(exposed);
+    }
+    return reply.redirect(settings.redirect);
   }
   throw new Error("Unknown auth type");
 }
@@ -1123,78 +1185,111 @@ var login = (ctx) => {
   });
   return cookies("oauth_state", cookie).redirect(`${AUTHORIZE}?${params}`);
 };
-var callback = async (ctx) => {
-  const body = ctx.body || {};
-  checkState(ctx, body.state);
+var exchange = async (code, redirectUri, user) => {
+  const params = new URLSearchParams({
+    client_id: env.APPLE_ID,
+    client_secret: await clientSecret(),
+    code: code ?? "",
+    grant_type: "authorization_code"
+  });
+  if (redirectUri) params.set("redirect_uri", redirectUri);
   const tokenRes = await fetch(TOKEN, {
     method: "POST",
     headers: {
       accept: "application/json",
       "content-type": "application/x-www-form-urlencoded"
     },
-    body: new URLSearchParams({
-      client_id: env.APPLE_ID,
-      client_secret: await clientSecret(),
-      code: body.code,
-      grant_type: "authorization_code",
-      redirect_uri: `${ctx.url.origin}/auth/callback/apple`
-    })
+    body: params
   });
   if (!tokenRes.ok) throw new Error("apple: token exchange failed");
   const token = await tokenRes.json();
   const claims = b64urlJson(token.id_token.split(".")[1]);
   let name;
-  if (body.user) {
-    const parsed = JSON.parse(body.user).name;
+  if (user) {
+    const parsed = JSON.parse(user).name;
     if (parsed) name = `${parsed.firstName} ${parsed.lastName}`.trim();
   }
-  const raw = { ...claims, name };
+  return { ...claims, name };
+};
+var finish = async (ctx, raw, opts) => {
   const { onProfile } = ctx.options.auth;
   const profile = onProfile ? await onProfile(raw, "apple") : { id: raw.sub, name: raw.name, email: raw.email };
   assertUser(profile, "onProfile");
-  const res = await finishLogin(ctx, {
-    provider: "apple",
-    key: profile.id,
-    email: profile.email,
-    user: profile
-  });
+  return finishLogin(
+    ctx,
+    {
+      provider: "apple",
+      key: profile.id,
+      email: profile.email,
+      user: profile
+    },
+    opts
+  );
+};
+var callback = async (ctx) => {
+  const body = ctx.body || {};
+  checkState(ctx, body.state);
+  const url = `${ctx.url.origin}/auth/callback/apple`;
+  const raw = await exchange(body.code, url, body.user);
+  const res = await finish(ctx, raw);
   res.headers.append("set-cookie", clearState());
   return res;
 };
-var apple_default = { login, callback };
+var verify = async (ctx) => {
+  const { code, redirect_uri, user } = ctx.body ?? {};
+  if (!code) throw ServerError_default.AUTH_NO_CODE();
+  const raw = await exchange(code, redirect_uri, user);
+  return finish(ctx, raw, { json: true });
+};
+var apple_default = { login, callback, verify };
 
 // src/auth/providers/oauth.ts
+var wantsJson = (ctx) => String(ctx.headers.accept || "").includes("application/json");
+var clientParams = (source) => ({
+  redirect_uri: source.redirect_uri,
+  state: source.state,
+  code_challenge: source.code_challenge,
+  code_challenge_method: source.code_challenge ? "S256" : void 0
+});
 function oauthProvider(config2) {
   const KEY = config2.name.toUpperCase();
   const callbackUrl = (ctx) => `${ctx.url.origin}/auth/callback/${config2.name}`;
-  const login3 = (ctx) => {
-    const { state, cookie } = startState(ctx);
-    const params = new URLSearchParams({
+  const authorizeUrl2 = (params) => {
+    const search = new URLSearchParams({
       client_id: env[`${KEY}_ID`],
-      redirect_uri: callbackUrl(ctx),
       response_type: "code",
-      scope: config2.scope,
-      state
+      scope: config2.scope
     });
-    return cookies("oauth_state", cookie).redirect(
-      `${config2.authorizeUrl}?${params}`
-    );
+    for (const [key, value] of Object.entries(params)) {
+      if (value) search.set(key, value);
+    }
+    return `${config2.authorizeUrl}?${search}`;
   };
-  const callback3 = async (ctx) => {
-    checkState(ctx, ctx.url.query.state);
+  const login3 = (ctx) => {
+    if (wantsJson(ctx)) {
+      return json({ url: authorizeUrl2(clientParams(ctx.url.query)) });
+    }
+    const { state, cookie } = startState(ctx);
+    const url = authorizeUrl2({ redirect_uri: callbackUrl(ctx), state });
+    return cookies("oauth_state", cookie).redirect(url);
+  };
+  const exchange2 = async (ctx, code, extra) => {
+    const body = new URLSearchParams({
+      client_id: env[`${KEY}_ID`],
+      client_secret: env[`${KEY}_SECRET`],
+      code,
+      grant_type: "authorization_code"
+    });
+    for (const [key, value] of Object.entries(extra)) {
+      if (value) body.set(key, value);
+    }
     const tokenRes = await fetch(config2.tokenUrl, {
       method: "POST",
       headers: {
         accept: "application/json",
         "content-type": "application/x-www-form-urlencoded"
       },
-      body: new URLSearchParams({
-        client_id: env[`${KEY}_ID`],
-        client_secret: env[`${KEY}_SECRET`],
-        code: ctx.url.query.code,
-        grant_type: "authorization_code",
-        redirect_uri: callbackUrl(ctx)
-      })
+      body
     });
     if (!tokenRes.ok) throw new Error(`${config2.name}: token exchange failed`);
     const token = await tokenRes.json();
@@ -1205,20 +1300,39 @@ function oauthProvider(config2) {
       }
     });
     if (!profileRes.ok) throw new Error(`${config2.name}: profile fetch failed`);
-    const raw = await profileRes.json();
+    return profileRes.json();
+  };
+  const finish3 = async (ctx, raw, opts) => {
     const { onProfile } = ctx.options.auth;
     const profile = onProfile ? await onProfile(raw, config2.name) : config2.profile(raw);
     assertUser(profile, "onProfile");
-    const res = await finishLogin(ctx, {
-      provider: config2.name,
-      key: profile.id,
-      email: profile.email,
-      user: profile
+    return finishLogin(
+      ctx,
+      {
+        provider: config2.name,
+        key: profile.id,
+        email: profile.email,
+        user: profile
+      },
+      opts
+    );
+  };
+  const callback3 = async (ctx) => {
+    checkState(ctx, ctx.url.query.state);
+    const raw = await exchange2(ctx, ctx.url.query.code, {
+      redirect_uri: callbackUrl(ctx)
     });
+    const res = await finish3(ctx, raw);
     res.headers.append("set-cookie", clearState());
     return res;
   };
-  return { login: login3, callback: callback3 };
+  const verify4 = async (ctx) => {
+    const { code, redirect_uri, code_verifier } = ctx.body ?? {};
+    if (!code) throw ServerError_default.AUTH_NO_CODE();
+    const raw = await exchange2(ctx, code, { redirect_uri, code_verifier });
+    return finish3(ctx, raw, { json: true });
+  };
+  return { login: login3, callback: callback3, verify: verify4 };
 }
 
 // src/auth/providers/discord.ts
@@ -1250,10 +1364,10 @@ async function emailLogin(ctx) {
   if (!/@/.test(email)) throw ServerError_default.LOGIN_INVALID_EMAIL();
   if (!password) throw ServerError_default.LOGIN_NO_PASSWORD();
   if (password.length < 8) throw ServerError_default.LOGIN_INVALID_PASSWORD();
-  const store = ctx.options.auth.store;
-  if (!await store.has(email)) throw ServerError_default.LOGIN_WRONG_EMAIL();
-  const user = await store.get(email);
-  const isValid = await verify(password, user.password);
+  const users = ctx.options.auth.users;
+  if (!await users.has(email)) throw ServerError_default.LOGIN_WRONG_EMAIL();
+  const user = await users.get(email);
+  const isValid = await verify2(password, user.password);
   if (!isValid) throw ServerError_default.LOGIN_WRONG_PASSWORD();
   return finishLogin(ctx, {
     provider: "email",
@@ -1268,8 +1382,8 @@ async function emailRegister(ctx) {
   if (!/@/.test(email)) throw ServerError_default.REGISTER_INVALID_EMAIL();
   if (!password) throw ServerError_default.REGISTER_NO_PASSWORD();
   if (password.length < 8) throw ServerError_default.REGISTER_INVALID_PASSWORD();
-  const store = ctx.options.auth.store;
-  if (await store.has(email)) throw ServerError_default.REGISTER_EMAIL_EXISTS();
+  const users = ctx.options.auth.users;
+  if (await users.has(email)) throw ServerError_default.REGISTER_EMAIL_EXISTS();
   const time = (/* @__PURE__ */ new Date()).toISOString().replace(/\.[0-9]*/, "");
   const user = {
     id: createId(email),
@@ -1291,12 +1405,12 @@ async function emailResetPassword() {
 }
 async function emailUpdatePassword(ctx) {
   const passwords = ctx.body;
-  const fullUser = await ctx.options.auth.store.get(ctx.user.email);
+  const fullUser = await ctx.options.auth.users.get(ctx.user.email);
   if (!fullUser) throw ServerError_default.AUTH_NO_USER();
-  const isValid = await verify(passwords.previous, fullUser.password);
+  const isValid = await verify2(passwords.previous, fullUser.password);
   if (!isValid) throw ServerError_default.LOGIN_WRONG_PASSWORD();
   fullUser.password = await hash2(passwords.updated);
-  await updateUser(fullUser, ctx.user, ctx.options.auth.store);
+  await updateUser(fullUser, ctx.user, ctx.options.auth.users);
   return 200;
 }
 var email_default = {
@@ -1322,7 +1436,8 @@ var facebook_default = oauthProvider({
 });
 
 // src/auth/providers/github.ts
-var oauth = async (code) => {
+var AUTHORIZE2 = "https://github.com/login/oauth/authorize";
+var oauth = async (code, extra) => {
   const fch = async (url, { body, headers: headers2 = {}, ...rest } = {}) => {
     headers2.accept = "application/json";
     headers2["content-type"] = "application/json";
@@ -1330,13 +1445,17 @@ var oauth = async (code) => {
     if (!res2.ok) throw new Error("Invalid request");
     return res2.json();
   };
+  const params = {
+    client_id: env.GITHUB_ID,
+    client_secret: env.GITHUB_SECRET,
+    code
+  };
+  for (const [key, value] of Object.entries(extra)) {
+    if (value) params[key] = value;
+  }
   const res = await fch("https://github.com/login/oauth/access_token", {
     method: "post",
-    body: JSON.stringify({
-      client_id: env.GITHUB_ID,
-      client_secret: env.GITHUB_SECRET,
-      code
-    })
+    body: JSON.stringify(params)
   });
   return (path) => {
     return fch(`https://api.github.com${path}`, {
@@ -1344,19 +1463,25 @@ var oauth = async (code) => {
     });
   };
 };
-var login2 = (ctx) => {
-  const { state, cookie } = startState(ctx);
-  const params = new URLSearchParams({
+var authorizeUrl = (params) => {
+  const search = new URLSearchParams({
     client_id: env.GITHUB_ID,
-    scope: "user:email",
-    state
+    scope: "user:email"
   });
-  return cookies("oauth_state", cookie).redirect(
-    `https://github.com/login/oauth/authorize?${params}`
-  );
+  for (const [key, value] of Object.entries(params)) {
+    if (value) search.set(key, value);
+  }
+  return `${AUTHORIZE2}?${search}`;
+};
+var login2 = (ctx) => {
+  if (wantsJson(ctx)) {
+    return json({ url: authorizeUrl(clientParams(ctx.url.query)) });
+  }
+  const { state, cookie } = startState(ctx);
+  return cookies("oauth_state", cookie).redirect(authorizeUrl({ state }));
 };
-var getUserProfile = async (code) => {
-  const api = await oauth(code);
+var getUserProfile = async (code, extra = {}) => {
+  const api = await oauth(code, extra);
   const [profile, emails] = await Promise.all([
     api("/user"),
     api("/user/emails")
@@ -1372,22 +1497,35 @@ var defaultProfile = (raw) => ({
   location: raw.location,
   created: raw.created_at
 });
-var callback2 = async (ctx) => {
-  checkState(ctx, ctx.url.query.state);
-  const raw = await getUserProfile(ctx.url.query.code);
+var finish2 = async (ctx, raw, opts) => {
   const { onProfile } = ctx.options.auth;
   const profile = onProfile ? await onProfile(raw, "github") : defaultProfile(raw);
   assertUser(profile, "onProfile");
-  const res = await finishLogin(ctx, {
-    provider: "github",
-    key: profile.id,
-    email: profile.email,
-    user: profile
-  });
+  return finishLogin(
+    ctx,
+    {
+      provider: "github",
+      key: profile.id,
+      email: profile.email,
+      user: profile
+    },
+    opts
+  );
+};
+var callback2 = async (ctx) => {
+  checkState(ctx, ctx.url.query.state);
+  const raw = await getUserProfile(ctx.url.query.code);
+  const res = await finish2(ctx, raw);
   res.headers.append("set-cookie", clearState());
   return res;
 };
-var github_default = { login: login2, callback: callback2 };
+var verify3 = async (ctx) => {
+  const { code, redirect_uri, code_verifier } = ctx.body ?? {};
+  if (!code) throw ServerError_default.AUTH_NO_CODE();
+  const raw = await getUserProfile(code, { redirect_uri, code_verifier });
+  return finish2(ctx, raw, { json: true });
+};
+var github_default = { login: login2, callback: callback2, verify: verify3 };
 
 // src/auth/providers/google.ts
 var google_default = oauthProvider({
@@ -1437,7 +1575,7 @@ function defaultOnUser(fullUser) {
   return user;
 }
 var available = Object.keys(providers_default);
-function parseAuthOptions(auth2, all) {
+function parseAuthOptions(auth2) {
   if (!auth2) return null;
   if (typeof auth2 === "string") {
     const [strategy2, provider] = auth2.split(":");
@@ -1460,15 +1598,8 @@ function parseAuthOptions(auth2, all) {
   const redirect2 = auth2.redirect || defaultRedirect;
   const { onProfile, onLogin, onLogout } = auth2;
   const onUser = auth2.onUser || defaultOnUser;
-  if (!auth2.store && !all.store) {
-    throw new Error("Need a userStore store for Auth");
-  }
-  if (!auth2.session && !all.store) {
-    throw new Error("Need a sessionStore store for Auth");
-  }
-  const store = all.store ? toStore(all.store) : null;
-  const authStore = auth2.store ? toStore(auth2.store) : store.prefix("user:");
-  const sessionStore = auth2.session ? toStore(auth2.session) : store.prefix("auth:");
+  const onToken = auth2.onToken || defaultOnUser;
+  const users = auth2.users ? toStore(auth2.users) : null;
   return {
     strategy,
     providers: list,
@@ -1476,9 +1607,9 @@ function parseAuthOptions(auth2, all) {
     onProfile,
     onLogin,
     onUser,
+    onToken,
     onLogout,
-    store: authStore,
-    session: sessionStore
+    users
   };
 }
 
@@ -1687,7 +1818,11 @@ function config(options = {}) {
     parser: options.parser ?? "parse",
     // Secure-by-default response headers + trustProxy for ctx.ip. `false` turns
     // the added headers off; see resolveSecurity for the defaults.
-    security: resolveSecurity(options.security)
+    security: resolveSecurity(options.security),
+    // Sessions: one record per device, exposed as ctx.session. Anything
+    // polystore accepts works; raw sources (a Map, a Redis client) get a 1w
+    // expiry, a built store is honored as-is, prefix and expiry included.
+    sessions: toStoreExpiring(options.sessions ?? /* @__PURE__ */ new Map(), "1w")
   };
   if (options.cache !== void 0) settings.cache = options.cache;
   options.cors = options.cors || env2.CORS || null;
@@ -1741,16 +1876,26 @@ function config(options = {}) {
   }
   const favicon2 = options.favicon || env2.FAVICON;
   if (favicon2) settings.favicon = favicon2;
-  settings.store = options.store ? toStore(options.store) : null;
-  if (options.session) {
-    const store = typeof options.session === "object" && "store" in options.session ? options.session.store : options.session;
-    settings.session = { store: toStore(store) };
-  }
-  if (settings.store && !options.session) {
-    settings.session = { store: settings.store.prefix("session:") };
-  }
+  const production = env2.NODE_ENV === "production";
+  const defaulted = options.sessions == null;
+  settings.sessionsDefault = defaulted;
   if (options.auth || env2.AUTH) {
-    settings.auth = parseAuthOptions(options.auth || env2.AUTH || null, options);
+    settings.auth = parseAuthOptions(options.auth || env2.AUTH || null);
+  }
+  if (settings.auth) {
+    if (!settings.auth.users) {
+      if (production) {
+        throw new Error(
+          "Auth in production needs a persistent `users` store, like auth: { ..., users: kv(redis).prefix('users:') }."
+        );
+      }
+      settings.auth.users = toStore(/* @__PURE__ */ new Map());
+    }
+    if (production && defaulted && !settings.auth.strategy.includes("jwt")) {
+      throw new Error(
+        "Auth in production needs a persistent `sessions` store, like sessions: kv(redis).prefix('session:')."
+      );
+    }
   }
   if (settings.auth?.strategy.includes("jwt") && settings.secret.startsWith("unsafe-")) {
     console.warn(
@@ -1774,7 +1919,7 @@ function config(options = {}) {
   }
   if (settings.public) log.message("public", loc(options.public));
   if (settings.uploads) log.message("uploads", loc(options.uploads));
-  if (settings.session) log.message("session", "enabled");
+  if (options.sessions) log.message("sessions", "enabled");
   if (settings.cors) {
     const origin = settings.cors.origin === true ? "*" : String(settings.cors.origin);
     log.message("cors", origin);
@@ -1885,6 +2030,14 @@ function getMachine() {
 }
 
 // src/parseResponse.ts
+var warned = false;
+var warnDefault = () => {
+  if (warned) return;
+  warned = true;
+  console.warn(
+    "[server:sessions] Using the default in-memory session store in production: sessions are lost on restart and not shared across instances. Configure one with sessions: kv(redis).prefix('session:')."
+  );
+};
 async function parseResponse(out, ctx) {
   if (!out && typeof out !== "string") return null;
   if (typeof out === "function") {
@@ -1952,11 +2105,14 @@ async function parseResponse(out, ctx) {
   if (ctx.time?.times?.length > 1) {
     out.headers.set("Server-Timing", ctx.time.headers());
   }
-  if (Object.keys(ctx.session || {}).length) {
-    if (!ctx.options.session?.store) {
-      throw ServerError_default.NO_STORE();
+  const prev = loaded.get(ctx);
+  const jwt = ctx.options.auth?.strategy.includes("jwt");
+  const data = jwt ? "{}" : JSON.stringify(ctx.session ?? {});
+  if (!jwt && data !== (prev?.data ?? "{}")) {
+    if (ctx.options.sessionsDefault && ctx.platform.production) {
+      warnDefault();
     }
-    let id = ctx.cookies.session;
+    let id = prev?.id;
     if (!id) {
       id = createId();
       out.headers.append(
@@ -1970,7 +2126,7 @@ async function parseResponse(out, ctx) {
         })
       );
     }
-    ctx.options.session.store.set(id, ctx.session);
+    ctx.options.sessions.set(id, ctx.session);
   }
   if (ctx?.res?.headers) {
     for (const key in ctx.res.headers) {
@@ -2252,7 +2408,7 @@ function timingSafeEqual(a, b) {
   }
   return mismatch === 0;
 }
-async function verify(password, hash3) {
+async function verify2(password, hash3) {
   if ("Bun" in globalThis) {
     return Bun.password.verify(password, hash3, "argon2id");
   }
@@ -2286,94 +2442,72 @@ async function verify(password, hash3) {
   });
 }
 
-// src/auth/findSessionId.ts
-var validateToken = (authorization) => {
-  const [type2, id] = authorization.trim().split(" ");
-  if (type2?.toLowerCase() !== "bearer") {
+// src/auth/getUser.ts
+async function getJwtUser(ctx) {
+  const header = ctx.headers.authorization;
+  if (!header) return;
+  const [type2, token] = header.trim().split(" ");
+  if (type2?.toLowerCase() !== "bearer" || !token) {
     throw ServerError_default.AUTH_INVALID_HEADER({ type: type2 });
   }
-  if (id?.length !== 16) {
-    throw ServerError_default.AUTH_INVALID_TOKEN();
-  }
-  return id;
-};
-var validateCookie = (authorization) => {
-  if (authorization.length !== 16) {
-    throw ServerError_default.AUTH_INVALID_COOKIE();
-  }
-  return authorization;
-};
-function findSessionId(ctx) {
-  const strategy = ctx.options.auth.strategy;
-  if (!strategy) throw new Error(`Invalid strategy "${strategy}"`);
-  if (strategy.includes("token")) {
-    if (!ctx.headers.authorization) return;
-    return validateToken(ctx.headers.authorization);
-  }
-  if (strategy.includes("cookie")) {
-    if (!ctx.cookies.authentication) return;
-    return validateCookie(ctx.cookies.authentication);
+  const payload = await verifyJwt(token, ctx.options.secret);
+  if (!payload) throw ServerError_default.AUTH_INVALID_TOKEN();
+  const { iat, exp, ...claims } = payload;
+  if (!claims.id || !claims.email) throw ServerError_default.AUTH_INVALID_TOKEN();
+  if (!ctx.options.auth.providers.includes(claims.provider)) {
+    throw ServerError_default.AUTH_INVALID_PROVIDER({
+      provider: claims.provider,
+      valid: ctx.options.auth.providers
+    });
   }
-  throw new Error(`Invalid auth type "${strategy}"`);
+  const exposed = await ctx.options.auth.onUser(claims, ctx);
+  assertUser(exposed, "onUser");
+  return exposed;
 }
-
-// src/auth/getUser.ts
 async function getAuthSession(ctx) {
-  const strategy = ctx.options.auth.strategy;
-  if (strategy.includes("jwt")) {
-    const header = ctx.headers.authorization;
-    if (!header) return;
-    const [type2, token] = header.trim().split(" ");
-    if (type2?.toLowerCase() !== "bearer" || !token) {
-      throw ServerError_default.AUTH_INVALID_HEADER({ type: type2 });
-    }
-    const payload = await verifyJwt(token, ctx.options.secret);
-    if (!payload) throw ServerError_default.AUTH_INVALID_TOKEN();
-    return payload;
+  let session2 = ctx.session;
+  if (!session2) {
+    const id = findSessionId(ctx);
+    if (!id) return;
+    session2 = await ctx.options.sessions.get(id) ?? void 0;
   }
-  const id = findSessionId(ctx);
-  if (!id) return;
-  return ctx.options.auth.session.get(id);
+  if (!session2?.user) return;
+  return session2;
 }
 async function getUser(ctx) {
   if (!ctx.options.auth) return;
   const options = ctx.options.auth;
+  if (options.strategy.includes("jwt")) return getJwtUser(ctx);
   const auth2 = await getAuthSession(ctx);
   if (!auth2) return;
-  if (options.strategy !== auth2.strategy) {
-    throw ServerError_default.AUTH_INVALID_STRATEGY({
-      strategy: auth2.strategy || "undefined",
-      valid: options.strategy
-    });
-  }
   if (!options.providers.includes(auth2.provider)) {
     throw ServerError_default.AUTH_INVALID_PROVIDER({
       provider: auth2.provider,
       valid: options.providers
     });
   }
-  const user = await ctx.options.auth.store.get(auth2.user);
+  const user = await options.users.get(auth2.user);
   if (!user) throw ServerError_default.AUTH_NO_USER();
-  user.strategy = auth2.strategy;
-  user.provider = auth2.provider;
-  const exposed = await ctx.options.auth.onUser(user, ctx);
+  const exposed = await options.onUser(user, ctx);
   assertUser(exposed, "onUser");
   return exposed;
 }
 
 // src/auth/logout.ts
 async function logout(ctx) {
-  const { strategy } = ctx.user;
-  if (!strategy) throw new Error(`Invalid strategy "${strategy}"`);
+  const { strategy } = ctx.options.auth;
   if (!strategy.includes("jwt")) {
-    await ctx.options.auth.session.del(findSessionId(ctx));
+    const prev = loaded.get(ctx);
+    if (prev?.id) await ctx.options.sessions.del(prev.id);
+    ctx.session = {};
+    loaded.set(ctx, { id: void 0, data: "{}" });
   }
   if (ctx.options.auth.onLogout) await ctx.options.auth.onLogout(ctx);
   if (strategy.includes("token") || strategy.includes("jwt")) {
     return { token: null };
   }
   if (strategy.includes("cookie")) {
-    return cookies({ authentication: null }).redirect("/");
+    return cookies({ session: null }).redirect("/");
   }
   throw new Error("Unknown auth type");
 }
@@ -2399,6 +2533,7 @@ function auth(app) {
     if (!env[`${key}_SECRET`]) throw new Error(`${key}_SECRET not defined`);
     app.get(`/auth/login/${name}`, providers_default[name].login);
     app.get(`/auth/callback/${name}`, providers_default[name].callback);
+    app.post(`/auth/verify/${name}`, providers_default[name].verify);
   }
   if (enabled.includes("apple")) {
     const keys = ["APPLE_ID", "APPLE_TEAM_ID", "APPLE_KEY_ID", "APPLE_PRIVATE_KEY"];
@@ -2407,6 +2542,7 @@ function auth(app) {
     }
     app.get("/auth/login/apple", providers_default.apple.login);
     app.post("/auth/callback/apple", providers_default.apple.callback);
+    app.post("/auth/verify/apple", providers_default.apple.verify);
   }
   if (enabled.includes("email")) {
     app.post("/auth/register/email", providers_default.email.register);
@@ -2681,39 +2817,6 @@ function preflight(ctx) {
   return 204;
 }
 
-// src/middle/NoSession.ts
-var NoSession = class {
-};
-function createNoSession() {
-  return new Proxy(NoSession, {
-    get(target, key) {
-      if (target[key]) return target[key];
-      if (key === "then") return target[key];
-      if (typeof key === "symbol") return target[key];
-      throw ServerError_default.NO_STORE_READ({ key: String(key) });
-    },
-    set(target, key, value) {
-      if (target[key] || key === "then" || typeof key === "symbol") {
-        target[key] = value;
-        return true;
-      }
-      throw ServerError_default.NO_STORE_WRITE({ key: String(key) });
-    }
-  });
-}
-
-// src/middle/session.ts
-async function session(ctx) {
-  const store = ctx.options.session?.store;
-  if (!store) {
-    ctx.session = createNoSession();
-    return;
-  }
-  if (ctx.cookies.session) {
-    ctx.session = await store.get(ctx.cookies.session) || {};
-  }
-}
-
 // src/middle/timer.ts
 var createTime = () => {
   const times2 = [["init", performance.now()]];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.41.0",
+  "version": "0.42.0",
   "description": "A fully-fledged web server with routing, file uploads, sessions, static files, schema validation, websockets, testing, etc.",
   "homepage": "https://server-js.com/",
   "repository": "github:franciscop/server-next",
@@ -47,25 +47,21 @@
       "Github": "https://github.com/franciscop/server-next"
     },
     "documentation": {
-      "Documentation": [
-        "docs/0. Documentation.md",
-        "docs/1. Getting Started.md"
-      ],
-      "Guides": "docs/2. Guides.md",
-      "Options": "docs/3. Options.md",
-      "Router": "docs/4. Router.md",
-      "Context": "docs/5. Context.md",
-      "Reply": "docs/6. Reply.md",
-      "Authentication": "docs/7. Authentication.md",
-      "Testing": "docs/8. Testing.md",
-      "Platforms": "docs/9. Platforms.md",
-      "FAQ": "docs/A. FAQ.md"
+      "Documentation": "docs/0. Documentation.md",
+      "Options": "docs/1. Options.md",
+      "Router": "docs/2. Router.md",
+      "Context": "docs/3. Context.md",
+      "Reply": "docs/4. Reply.md",
+      "Authentication": "docs/5. Authentication.md",
+      "Testing": "docs/6. Testing.md",
+      "Platforms": "docs/7. Platforms.md",
+      "FAQ": "docs/8. FAQ.md"
     },
     "tutorials": "docs/tutorials"
   },
   "dependencies": {
     "bucket": "^0.7.1",
-    "polystore": "^0.24.0"
+    "polystore": "^0.26.0"
   },
   "devDependencies": {
     "@types/bun": "^1.3.0",

package/readme.md

@@ -9,21 +9,22 @@ npm install @server/next
 ```js
 import server from '@server/next';
 
-export default server({ store: new Map(), uploads: './uploads' })
+export default server({ uploads: './uploads' })
   .get('/', () => 'Hello world')
   .get('/users/:id', (ctx) => db.users.find(ctx.url.params.id))
   .post('/avatar', (ctx) => ctx.body.avatar.path);
 ```
 
-Key-value stores and file storage come included, so `store` takes a plain `Map` and `uploads` takes a folder path. For Redis, S3 and the rest, `kv` and `bucket` are exported too:
+Key-value stores and file storage come included, so `sessions` work out of the box and `uploads` takes a folder path. For Redis, S3 and the rest, pass the client straight in:
 
 ```js
-import server, { kv, bucket } from '@server/next';
+import server, { bucket } from '@server/next';
+import { createClient } from 'redis';
 
-const store = kv(createClient({ url }).connect());
+const sessions = createClient({ url });
 const uploads = bucket.S3('my-bucket', { id, key });
 
-export default server({ store, uploads });
+export default server({ sessions, uploads });
 ```
 
 See the [full documentation](https://serverjs.io/documentation).